Control over the IT process of Manage Changes that satisfies the business requirement for IT of
- responding to business requirements in alignment with the business strategy, whilst reducing solution and service delivery defects and rework
- controlling impact assessment, authorization and implementation of all changes to the IT infrastructure, applications and technical solutions; minimizing errors due to incomplete request specifications; and halting implementation of unauthorized changes
- Defining and communicating change procedures, including emergency changes
- Assessing, prioritizing and authorizing changes
- Tracking status and reporting on changes
- Number of disruptions or data errors caused by inaccurate specifications or incomplete impact assessment
- Amount of application or infrastructure rework caused by inadequate change specifications
- Percent of changes that follow formal change control processes
1 Non-existent
2 Initial/Ad Hoc
3 Repeatable but Intuitive
4 Defined
5 Managed and Measurable
6 Optimized
Benchmarks/Guidelines for Scoring
1 Non-existent when
There is no defined change management process, and changes can be made with virtually no control. There is no awareness that change can be disruptive for IT and business operations, and no awareness of the benefits of good change management.
2 Initial/Ad Hoc when
It is recognized that changes should be managed and controlled. Practices vary, and it is likely that unauthorized changes take place. There is poor or non-existent documentation of change, and configuration documentation is incomplete and unreliable. Errors are likely to occur together with interruptions to the production environment caused by poor change management.
3 Repeatable but Intuitive when
There is an informal change management process in place and most changes follow this approach; however, it is unstructured, rudimentary and prone to error. Configuration documentation accuracy is inconsistent, and only limited planning and impact assessment take place prior to a change.
4 Defined when
There is a defined formal change management process in place, including categorization, prioritization, emergency procedures, change authorisation and release management, and compliance is emerging. Workarounds take place, and processes are often bypassed. Errors may occur and unauthorized changes occasionally occur. The analysis of the impact of IT changes on business operations is becoming formalized, to support planned roll-outs of new applications and technologies.
5 Managed and Measurable when
The change management process is well developed and consistently followed for all changes, and management is confident that there are minimal exceptions. The process is efficient and effective, but relies on considerable manual procedures and controls to ensure that quality is achieved. All changes are subject to thorough planning and impact assessment to minimize the likelihood of post-production problems. An approval process for changes is in place. Change management documentation is current and correct, with changes formally tracked. Configuration documentation is generally accurate. IT change management planning and implementation are becoming more integrated with changes in the business processes, to ensure that training, organizational changes and business continuity issues are addressed. There is increased co-ordination between IT change management and business process redesign. There is a consistent process for monitoring the quality and performance of the change management process.
6 Optimized when
The change management process is regularly reviewed and updated to stay in line with good practices. The review process reflects the outcome of monitoring. Configuration information is computer-based and provides version control. Tracking of changes is sophisticated and includes tools to detect unauthorized and unlicensed software. IT change management is integrated with business change management to ensure that IT is an enabler in increasing productivity and creating new business opportunities for the organization.